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Abstract 

Risk-NL  is  a  Quantitative  Risk  Assessment  (QRA)  software  tool  for  the  external  safety  of 
ammunition  storage  sites.  The  Netherlands  MoD  has  asked  TNO  to  upgrade  Risk-NL  with 
improved  models  that  have  recently  been  developed,  and  a  new  user  interface. 

The  new  models  implemented  in  Risk-NL  v5.0  are  more  physics-based,  and  have  a  higher 
level  of  detail  resulting  in  a  better  quantitative  discrimination  of  risks  for  different  scenarios. 
The  most  important  improvement  is  the  possibility  to  distinguish  between  debris  from  walls 
and  the  roof  of  RC  magazines,  and  between  debris  and  primary  fragments  from  cased 
ammunition.  Also  the  new  model  for  window  failure  is  a  major  improvement  and  has  a  more 
sound  basis  than  its  predecessor. 

The  combination  of  the  new  user  interface  and  the  new  models  in  Risk-NL  v5.0  give  unique 
possibilities  to  analyze  risk,  and  to  investigate  options  for  risk  reduction.  Risk-NL  v5.0  also 
provides  possibilities  for  optimization  in  the  design  of  new  types  of  magazines  and 
ammunition  storage  sites. 

The  paper  gives  a  description  of  the  new  features  and  the  new  possibilities  are  illustrated  with 
a  case  study. 

1.  Introduction 

Risk-NL  is  a  Quantitative  Risk  Assessment  (QRA)  software  tool  for  the  external  safety  of  the 
storage  of  explosives  and  ammunition.  From  2001  to  2007  Risk-NL  v4.1  has  been  used  to 
analyse  the  external  safety  of  about  50  NLD  military  sites  where  activities  with  explosives 
and  ammunition  take  place.  In  this  period  Risk-NL  v4.1  has  been  kept  unchanged.  The 
Netherlands  MoD  has  asked  TNO  to  upgrade  Risk-NL  with  improved  models  that  have  been 
recently  developed,  and  a  new  user  interface.  This  has  led  to  an  upgrade  of  Risk-NL  v4.1  to 
Risk-NL  v5.0.  A  detailed  description  of  the  new  features  is  given  by  (Van  der  Voort,  2009) 
and  in  (AASTP-4,  2008),  while  a  brief  overview  is  given  in  Section  2,  3  and  4  of  this  paper. 
The  new  possibilities  are  illustrated  with  a  case  study  in  Section  5. 

Dutch  regulations  (MP  40-21,  2006)  demand  that  an  analysis  of  the  external  safety  of 
ammunition  storage  sites  consist  of  the  following  three  sequential  steps: 
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Internal  Safety 

First  the  internal  safety  is  analysed.  For  an  internally  safe  military  storage  site  sympathetic 
reactions  can  be  excluded;  a  detonation  in  one  magazine  cannot  cause  a  sympathetic 
detonation  in  another.  If  necessary,  changes  need  to  be  made  to  guarantee  internal  safety.  The 
remaining  part  of  the  analysis  is  based  on  the  condition  that  the  storage  site  is  internally  safe. 

ABC  Zoning 

The  A,  B  and  C  zone  are  determined  next.  These  zones  correspond  to  certain  effect  levels. 
Regulations  in  the  Netherlands  (MP  40-21,  2006)  state  which  external  objects  are  not  allowed 
to  be  present  within  these  zones.  Zone  A  stands  for  Public  Traffic  Route  Distance  (PTRD), 
Zone  B  stands  for  Inhabited  Building  Distance  (IBD),  and  Zone  C  is  usually  twice  Zone  B.  If 
a  conflicting  situation  exists  a  QRA  has  to  be  carried  out  in  order  to  quantify  the  risk. 

QRA 

Risk  is  determined  by  the  frequency  of  an  accidental  explosion,  its  consequences  in  terms  of 
the  probability  of  lethality,  and  the  exposure.  When  a  QRA  is  carried  out  both  the  Individual 
Risk  and  Societal  Risk  are  determined.  The  Individual  Risk  is  defined  as  the  risk  experienced 
by  an  unprotected  person  that  is  continuously  present  in  the  free  field.  The  Societal  Risk  is  a 
more  realistic  measure,  which  takes  into  account  the  actual  location  and  presence  of  persons. 
The  Societal  Risk  is  expressed  in  a  so-called  FN-curve.  The  last  step  in  a  QRA  is  the 
comparison  of  the  Individual  Risk  and  Societal  Risk  with  criteria. 

2  Internal  Safety 

The  analysis  of  the  Internal  Safety  is  carried  out  by  default  with  the  QD  tables  from  (MP40- 
21,  2006).  Dependent  on  the  relevant  combinations  of  PES  (Potentially  Explosive  Sites)  or  ES 
(Exposed  Sites)  magazine  types,  these  QD-tables  give  the  required  inter-magazine  distances 
(Figure  1).  PES  and  ES  are  also  referred  to  as  ‘donor’  and  ‘acceptor’. 
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Figure  1 .  Internal  Safety  Table  from  ( MP40-21 ,  2006) 

With  Risk-NL  v5.0  the  analysis  can  additionally  be  conducted  with  other  QD  tables,  such  as 
those  given  in  (AASTP-1,  2006).  The  number  of  magazine  types  is  much  larger  in  the  latter 
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case  (33  instead  of  1 1)  which  enables  the  user  to  account  more  specifically  for  different 
storage  structures. 

3  ABC  Zoning 

In  general,  the  IBD  (B-Zone)  for  HD1. 1  is  determined  by  either  blast  or  debris.  The  blast  IBD 
given  by  AASTP-1  is  based  on  a  5  kPa  blast  overpressure  criterion  (dashed  black  curve  in 
Figure  2).  For  debris,  AASTP-1  poses  a  criterion  of  1  lethal  piece  of  debris  per  56  m2, 
resulting  in  a  minimum  IBD  of  400  m.  This  implies  that  for  small  NEQ  the  IBD  is  determined 
by  a  fixed  (debris)  IBD  of  400  m. 

Improved  QD  relations  have  been  derived  within  the  precursor  project  ‘Small  Quantities 
NEQ’  (Verolme,  2006).  These  are  the  solid  lines  in  Figure  2.  The  improved  QD  relations  are 
data  fits  to  experimentally  determined  debris  IBDs  for  HD  1 . 1  ammunition,  also  shown  in 
Figure  2.  The  data  is  partly  based  on  (Swisdak,  2002),  and  has  been  extended  with  more 
recent  test  data.  The  data  set  contains  trials  with  brick  and  reinforced  concrete  (RC) 
magazines,  ISO  containers,  earth  covered  magazines  (ECM),  and  hardened  aircraft  shelters 
(HAS).  The  debris  IBDs  have  been  determined  according  to  the  PTN  (Pseudo  Trajectory 
Normal)  method  described  by  (Gould,  1998). 


Figure  2 .  Experimentally  determined  Debris  IBDs  plotted  together  with  QD  relations 

A  comparison  between  AASTP-1  and  the  dataset  leads  to  the  following  conclusions: 

•  The  observed  debris  IBDs  typically  supersede  the  AASTP-1  blast  IBD.  It  should 
however  be  realized  that  the  debris  IBDs  given  in  Figure  2  have  been  determined  in 
the  wall  normal  direction,  i.e.  the  direction  in  which  the  debris  throw  is  largest.  As  a 
result  the  blast  IBD  will  gain  importance  in  of-normal  directions. 

•  For  small  NEQ  (<500  kg)  experimentally  observed  debris  IBDs  are  significantly 
smaller  than  400  m.  The  largest  observed  debris  IBDs  are  for  small  scale  experiments 
with  brick  and  RC  magazines  (typical  size  1-2  m).  The  small  volume  of  these 
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structures  leads  to  relatively  high  loading  densities,  debris  velocities  and  hence  IBDs. 
This  data  has  however  not  been  used  as  input  for  the  improved  QD  relation  for 
Brick/RC,  because  these  tests  are  not  representative  for  ammunition  magazines  in  the 
Netherlands.  The  improved  QD  relation  for  Brick/RC  has  been  based  on  UK  and  US 
full  scale  testing. 

•  Other  data  fits  are  used  for  the  front  and  sides  of  ECMs,  for  which  trials  show 
containment  below  20  kg.  The  debris  IBD  at  the  sides  of  an  ECM  is  significantly 
smaller  as  compared  to  its  front  in  the  small  NEQ  regime.  Figure  2  also  shows  data 
for  HASs  which  exhibit  even  smaller  debris  IBDs.  No  data  fit  has  been  obtained  for 
this  structure  type. 

With  Risk-NL  v5.0  the  calculation  of  the  ABC  Zoning  is  carried  out  with  the  improved  QD 
relations. 


4  Quantitative  Risk  Assessment  (QRA) 

The  QRA  calculations  in  Risk-NL  have  been  improved  with  new  models  which  have  been 
developed  within  the  research  program  V402  ‘Safety  of  Personnel’.  This  section  gives  a 
general  overview  of  the  QRA  calculations  in  Risk-NL  v5.0. 

4. 1  The  Risk  equation 

The  basis  of  the  QRA  calculations  is  the  Risk  equation: 


—  P  .  P  .  P 

iUJ/v  event  ±  lethal  ±  exposure 


(l/year)  (1) 


Risk  consists  of  a  multiplication  of  three  equally  important  contributions; 

•  The  event  frequency  (1/year) 

•  The  probability  of  lethality  given  the  event  (-) 

•  The  probability  of  exposure  (-) 


The  event  takes  place  at  a  Potentially  Explosive  Site  (PES).  In  a  Quantitative  Risk 
Assessment  (QRA)  for  the  external  safety,  an  Exposed  Site  (ES)  is  a  location  outside  the 
storage  site  to  which  persons  are  associated.  Examples  are  persons  in  the  free  field,  in 
buildings,  or  in  vehicles. 


From  the  risk  equation  follows  that  if  any  of  the  contributions  equals  zero,  the  risk  is  also 
equal  to  zero.  As  a  result  three  ways  to  reduce  the  risk  can  be  identified; 

•  Prevention  (reduction  of  the  event  frequency).  This  can  be  achieved  by  following 
safety  procedures,  for  example  those  specified  in  the  (MP40-21,  2006). 

•  Mitigation  (reduction  of  the  consequences  of  an  event).  This  can  be  achieved  by 
taking  measures  at  the  PES.  An  example  is  to  reduce  the  NEQ.  Another  possibility  is 
to  take  measures  at  the  ES.  Examples  are  a  reinforced  construction  or  a  protective 
barrier. 

•  Reduction  of  the  exposure  to  the  event.  If  possible  the  presence  of  persons  in  the 
vicinity  of  a  PES  can  be  minimized. 

The  risk  equation  also  makes  clear  that  an  event  with  a  large  event  frequency  but  a  small 
consequence,  might  lead  to  the  same  risk  as  an  event  with  a  small  event  frequency  but  a  large 
consequence.  In  other  words,  the  three  contributions  in  the  risk  equation  are  interchangeable. 
If  the  event  frequency  is  set  to  ‘  1  ’  we  are  performing  a  consequence  analysis.  In  this  case  we 
calculate  the  probability  of  lethality  given  a  certain  scenario. 
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The  probability  of  lethality  consists  of  contributions  from  various  explosion  effects  and 
lethality  mechanisms.  The  explosion  effects  (blast,  fragment  and  debris  throw,  and  thermal 
radiation),  and  as  a  result  also  the  probability  of  lethality,  strongly  depend  on  the  location 
relative  to  the  event.  The  varying  risk  in  the  vicinity  of  a  PES  is  also  called  the  risk  field. 

In  practice,  many  explosion  events  (scenarios)  are  important,  each  with  their  own  frequency 
of  occurrence.  Within  a  PES,  scenarios  may  vary  from  a  deflagration  of  a  number  of  items  to 
a  mass  detonation  of  the  entire  contents.  Furthermore  various  PES’s  are  often  present  at  an 
ammunition  storage  site.  The  overall  risk  consists  of  a  summation  over  all  relevant  scenarios. 

4.2  Risk-NL  Scenarios 

With  Risk-NL  only  one  scenario  per  PES  is  taken  into  account.  This  is  the  Maximum 
Credible  Event  (MCE),  for  which  it  is  assumed  that: 

•  The  NEQ  involved  in  the  MCE  (explosive  reaction  or  detonation)  is  equal  to  the 
licensed  NEQ  for  each  of  the  three  hazard  divisions. 

•  The  probability  of  lethality  at  a  certain  location  is  the  maximum  value  of  the 
contributions  from  the  three  hazard  divisions. 

•  The  explosion  effects  take  place  instantaneously,  leaving  no  time  for  escape. 

Furthermore  it  is  important  to  note  that  the  mixing  and  aggregation  rules  from  (AASTP-1, 
2006)  apply.  This  means  that  if  HD  1.1  and  HD  1.2  are  stored  simultaneously,  the  total  NEQ 
has  to  be  considered  as  HD  1.1.  This  total  amount  can  not  exceed  the  licensed  amount  of 
HD  1.1. 

The  event  frequency  has  been  based  on  a  study  of  available  accident  data  from  several  NATO 
countries  covering  the  time  period  1960-1980.  A  distinction  is  made  between  regular  storage, 
irregular  storage  and  storage  in  vehicles  on  the  site,  and  workshop  ammunition  activities.  The 
results  are  not  presented  in  the  current  paper. 

4. 3  Probability  of  lethality 

The  probability  of  lethality  consists  of  contributions  from  various  explosion  effects  and 
related  lethality  mechanisms.  Results  are  generated  for  persons  in  the  free  field  (FF),  in 
buildings  (HS)  and  in  vehicles  (RD).  An  overview  is  given  in  Table  2. 

Blast 

All  explosives  and  ammunition  with  the  potential  for  a  mass  detonation  are  classified  as 
HD  1.1.  Only  these  substances  can  cause  a  major  blast  wave.  For  most  magazine  types  the 
blast  wave  has  no  directional  dependence.  For  earth  covered  magazines  the  blast  wave  is 
reduced  in  the  rear  and  side  direction  of  the  magazine,  while  it  is  enhanced  at  the  front  side. 

An  important  blast  related  lethality  mechanism  is  lung  rupture,  caused  by  blast  loading  of  the 
thorax.  Head  and  body  impact  takes  place  after  acceleration  of  the  human  body,  primarily  by 
the  blast  wind.  For  persons  residing  in  buildings  and  vehicles  the  blast  loading  is  more 
complex.  The  blast  wave  first  reflects  at  the  structure  and  only  partly  enters  after  window 
failure.  The  reduced  blast  wave  then  reflects  at  walls,  giving  rise  to  local  high  overpressures. 
Taking  the  various  phenomena  into  account  it  is  assumed  that  the  blast  loading  of  a  person  in 
the  free  field  is  also  representative  for  persons  in  buildings  and  vehicles. 

Additional  lethality  mechanisms  for  persons  in  buildings  are  glass  shard  lacerations  due  to 
window  failure  and  building  collapse.  A  reflected  blast  loading  is  assumed  for  windows, 
because  usually  at  least  one  side  of  a  building  will  be  facing  the  PES.  The  new  window  failure 
and  lethality  model  is  described  in  another  paper  by  (van  Doormaal,  2010).  It  is  assumed  that 
during  an  explosion  event  25  %  of  all  persons  in  a  building  are  exposed  to  glass  shards  from 
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window  failure.  The  percentage  has  been  based  on  the  typical  locations  of  persons  within 
rooms  that  have  a  line  of  sight  more  or  less  perpendicular  to  windows. 


Table  2  Explosion  effects ,  hazard  divisions ,  lethality  mechanisms ,  and  relevancy  for  persons  in  the 
free  field ,  in  buildings ,  and  in  vehicles .  Assumptions  about  blast  loads ,  debris  and  fragments  and 
thermal  radiation  are  also  indicated. 

Lethality 
mechanism 


Explosion 

effect 


Blast 


Debris 

Horizontal 

Debris 

Vertical 

Thermal 


Hazard 

division 


HD  1.1 


Fragments  HD  1.1 
Horizontal 

HD  1.2 


Fragments  HD  1.1 

Vertical 


HD  1.2 


HD  1.1 


Explosion 
effect  relevant 
TF 


Relevant  for  persons  in 


Cased 
AND 

No  Barricade 

Cased 

AND 

No  Barricade 
Cased 

Cased 

No  Barricade 
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Debris  and  fragments 

For  cased  HD1.1  and  HD1.2,  primary  fragments  contribute  to  the  hazard.  For  HD1.1  (cased 
and  bare  explosives)  debris  generated  by  the  storage  structure  forms  an  additional  threat.  A 
new  model  for  fragment  and  debris  throw  has  been  implemented  in  Risk-NL  v5.0.  It  is  based 
on  available  open  literature  on  full  scale  explosion  trials,  and  is  more  physics-based  than  its 
predecessor. 
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Based  on  the  geometry  of  the  storage  structure  and  the  NEQ,  distributions  of  the  debris  and 
fragment  mass,  launch  velocity,  and  angle  are  specified.  All  fragment  and  debris  contributions 
are  expressed  in  the  10  Sci  Pan  mass  bins.  Impact  locations  are  calculated  using  an  analytical 
solution  to  the  equations  of  motion;  the  horizontal  drag  approximation  and  the  vertical  drag 
approximation  (Van  der  Voort,  2008-2).  The  source  function  theorem  is  an  efficient  method 
to  calculate  the  resulting  debris  density  in  horizontal  and  vertical  planes  (Van  der  Voort, 
2008-1). 


A  distinction  has  been  made  between  fragments  and  debris  launched  around  the  horizontal 
direction  (low  angle)  and  around  the  vertical  direction  (high  angle).  The  angular  distribution 
(source  function)  has  been  illustrated  in  Figure  3  (Side  view  and  Top  view).  The  distinction 
between  ‘horizontal’  and  ‘vertical’  debris  can  be  made  because  preferred  launch  directions  are 
more  or  less  perpendicular  to  structural  elements  (walls  and  roof).  For  fragments  the 
distinction  is  related  to  the  shell  placement,  which  is  mostly  vertical.  Low  angle  fragments 
originate  from  shells  at  the  sides  of  the  stack,  while  high  angle  fragments  are  launched  from 
shells  in  the  bulk  of  the  stack  (TP  16,  2009).  The  distinction  enables  the  user  to  quantify  the 
effect  of  barricades,  which  mitigate  the  low  angle  contributions. 


Figure  3.  Schematic  illustration  of  the  initial  angular  distribution  for  fragments  and  debris 


The  new  model  for  fragment  and  debris  throw  has  been  validated  against  a  large  number  of 
trials.  An  example  is  shown  in  Figures  4  and  5  for  a  trial  with  stacked  artillery  shells  (NEQ  of 
5  tonnes)  in  an  ISO  container  surrounded  by  barricades. 
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Figure  4.  Overview  of  the  5  tonnes  trial 


(Van  der  Voort ,  2008-1) 


Distance  (m) 

-  5  tonnes  trial 

- sim4.8deg 

-  sim  6.8  deg 

-  sim  8.8  deg 

Figure  5.  Fragment  density  in  the  horizontal  plane  versus  distance  (Van  der  Voort ,  2008-1). 

Experimental  data  and  calculation  results. 

The  fragment  pick-up  comprises  mainly  high  angle  fragments,  because  the  low  angle 
fragments  have  been  blocked  by  the  barricades.  A  good  match  is  obtained  between  model 
predictions  and  trial  data,  if  an  appropriate  choice  is  made  for  the  fragment  launch  angle 
distribution  (standard  deviation  6.8°).  This  model  has  also  been  used  to  develop  a 
consequence  analysis  method  for  field  storage  in  AASTP-5.  This  is  described  in  another  paper 
(Van  der  Voort,  2010-1)  and  (Van  der  Voort,  2010-2). 
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The  probability  of  lethality  due  to  fragment  and  debris  throw  consists  of  two  parts;  the  hit 
probability,  and  the  probability  of  lethality  given  a  hit.: 

p  -  p  .  p 

lethal  hit  lethal, hit  ^2^ 

The  hit  probability  of  a  person  strongly  depends  on  its  orientation.  Initially  a  standing 
orientation  is  assumed  for  persons  in  the  free  field  and  in  buildings.  This  is  the  worst  case 
situation  for  the  low  angle  fragments  and  debris.  High  angle  fragments  and  debris  impact 
much  later  (after  10’s  of  seconds).  By  that  time  it  is  likely  that  persons  have  a  laying 
orientation,  either  because  they  are  turned  over  by  the  blast  wave  or  because  they  tend  to  hide 
at  the  ground  level.  This  is  the  worst  case  situation  for  the  vertical  fragments  and  debris.  The 
area  of  the  human  body  (laying  or  standing)  is  taken  equal  to  0.56  m2  (AASTP-1,  2006). 

Persons  in  buildings  have  ballistic  protection  from  concrete  or  brick  walls.  It  is  determined 
which  fragments  and  debris  are  able  to  perforate  a  wall.  No  ballistic  protection  exists  when 
fragments  and  debris  enter  the  building  through  windows.  The  same  reasoning  is  applied  for 
persons  in  vehicles.  The  probability  of  lethality  depends  on  mass  and  impact  velocity,  and  is 
assessed  according  to  (PGS  1,  2003). 

Thermal  radiation 

The  last  contribution  to  the  probability  of  lethality  is  the  thermal  hazard,  primarily  caused  by 
HD  1.3.  This  hazard  consists  of  a  fireball  for  light  structures,  while  for  heavy  structures  a  jet 
flame  at  the  front  (doorside)  can  be  expected.  Persons  present  within  the  fireball  radius  or 
flame  jet  have  a  100  %  probability  of  lethality.  At  a  distance  persons  are  exposed  to  thermal 
radiation.  This  effect  is  reduced  for  persons  in  buildings  and  vehicles. 

4.4  Exposure  and  Risk  measures 

The  last  term  in  the  risk  equation  is  the  exposure. 

The  exposure  is  set  to  100%  for  the  calculation  of  the  Individual  Risk,  which  is  defined  as  the 
risk  experienced  by  an  unprotected  person  that  is  continuously  present  in  the  free  field  (FF). 
The  Individual  Risk  is  presented  with  risk  contours  to  the  Individual  Risk  field.  These 
contours  can  be  compared  with  criteria.  In  the  Netherlands  the  criterion  for  existing  situations 
is  10'5  /  year,  while  the  criterion  for  new  situations  is  10"6  /  year  (MP40-21,  2006).  Likewise 
risk  contours  can  be  calculated  and  presented  for  persons  in  buildings  (HS)  and  in  vehicles 
(RD),  but  these  have  no  formal  status. 

For  the  calculation  of  the  Societal  Risk,  more  realistic  values  of  the  exposure  are  used  in  order 
to  match  the  actual  presence  of  the  population.  Assumptions  about  the  presence  are  made  in 
accordance  with  (PGS  3,  2005)  and  (Handreiking  verantwoordingsplicht  groepsrisico,  2007). 
For  each  scenario  the  total  number  of  fatalities  at  the  ESs  is  calculated.  The  scenarios  are  then 
ordered  by  increasing  frequency  and  a  diagram  of  cumulative  frequency  versus  the  number  of 
fatalities  is  presented  next.  This  is  the  F/N  curve  which  represents  the  probability  of  a  certain 
number  of  fatalities  versus  the  yearly  probability  of  an  accident  with  that  number  of  fatalities 
or  less.  In  the  Netherlands,  the  probability  of  accidents  must  be  inversely  proportional  to  the 
square  o/the  number  of  fatalities  (MP40-21,  2006).  The  criterion  for  existing  situations  is 
10"4  for  a  group  of  10  persons,  while  for  new  situations  it  is  10"5  for  a  group  of  10  persons. 

4. 6  RiskCurves 

RiskCurves  is  a  user  friendly  risk  assessment  software  tool  developed  by  TNO  Built 
Environment  for  the  field  of  Industrial  Safety  (RiskCurves  user  manual,  2008).  In  cooperation 
with  TNO  Built  Environment  and  GeoSciences,  a  special  version  of  RiskCurves  has  been 
developed  that  is  dedicated  to  Risk-NL  calculations  (Sterkenburg,  2009). 
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RiskCurves  functions  as  a  user-interface  through  which  an  input  file  for  Risk-NL  can  be  set 
up.  Using  a  map  as  background,  the  ‘donor’  locations  and  other  properties  like  the  NEQ  of 
stored  explosives  and  geometry  of  the  storage  building  can  be  entered  in  easy  to  use  dialogs. 
RiskCurves  also  facilitates  a  number  of  ways  to  enter  population  in  an  area,  either 
permanently  or  temporarily.  There  are  map  based  editors  for  population  grids  for  day  time 
and  night  time  presence,  for  road  segments  (transportation  units)  with  their  associated  traffic 
intensities  and  velocities,  and  an  editor  for  short  duration  events  with  high  population 
concentrations  like  concerts  or  sports  events.  The  program  generates  a  text  based  input  file  for 
the  Risk-NL  calculation  kernel  and,  after  completion,  reads  its  output  to  process  it  further  into 
maps  and  charts. 

Furthermore,  calculation  and  presentation  of  the  ABC  Zoning,  Individual  Risk  contours  and 
Societal  Risk  (FN-curve)  is  carried  out  with  RiskCurves. 

5.  Case  study 

In  this  section  Risk-NL  v5.0  is  illustrated  with  a  case  study.  The  case  study  concerns  a 
(fictitious)  storage  site  with  a  few  dozen  ammunition  magazines.  After  starting  up  the 
program,  the  operator  creates  a  new  project  and  chooses  a  background  map.  Various 
commonly  used  types  of  map  file  formats  are  supported,  vector  based  as  well  as  raster  based. 
Population  grids,  traffic  data  and  population  concentrations  can  also  be  entered  now. 
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Figure  6. 


Entering  storage  locations  and  parameters  in  the  map  based  user  interface . 


The  first  step  is  to  enter  the  individual  storage  buildings  into  the  project.  New  locations  for 
buildings  can  be  dragged  onto  the  map  upon  which  the  dialog  appears  in  which  the  properties 
for  the  individual  buildings  can  be  entered,  as  illustrated  in  Figure  6. 


After  completing  the  input  data,  the  model  calculations  can  be  started.  Running  these 
typically  takes  a  few  seconds  up  to  one  minute  for  a  very  large  storage  site  (>  50  buildings). 
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The  calculation  module  will  signal  whether  the  storage  site  is  internally  safe  or  not  (see  also 
Section  2).  For  an  internally  safe  military  complex,  sympathetic  reactions  must  be  excluded;  a 
detonation  in  one  magazine  may  not  cause  a  sympathetic  detonation  in  another.  If  necessary, 
changes  need  to  be  made  to  guarantee  internal  safety.  Whether  or  not  the  site  is  internally  safe 
will  be  presented  on  each  map,  chart  and  printout. 


Figure  7.  ABC  zones  for  the  storage  site. 


NOT  internally  safe! 


F  ■  Zone  C 
F  ■  Zone  B 
l*  ■  Zone  A 


The  second  step  in  the  analysis  is  the  determination  of  the  ABC  zoning  (see  also  Section  3). 
The  overall  zones  for  the  site  are  calculated  as  the  unions  of  the  zones  of  the  individual 
storage  buildings.  The  ABC  zoning  for  the  present  case  study  is  shown  in  Figure  7.  If  a 
conflicting  situation  exists,  a  QRA  has  to  be  carried  out  in  order  to  quantify  the  risk.  This  is 
clearly  the  case,  because  some  external  objects  are  present  within  zone  B  at  the  east  side  of 
the  storage  site.  As  a  result  the  Individual  Risk  and  Societal  Risk  have  to  be  determined. 

Figure  8  shows  the  Individual  Risk  contours:  lines  on  the  map  which  represent  points  with  an 
equal  Individual  Risk  value.  Values  of  10"4,  10"5,  10"6,  10“7,  10"8,  and  10"9  per  year  are  shown. 
The  rather  irregular  shapes  of  the  contours  are  mainly  caused  by  the  strong  directional 
dependence  of  wall  debris,  associated  with  the  new  fragment  and  debris  throw  model.  The 
location  of  external  objects  has  to  be  compared  with  the  10"5  and  10"6  contour,  depending  on 
existing  or  new  situations  respectively. 

Figure  9  compares  Risk-NL  v5.0  with  Risk-NL  v4.1  for  the  10"5  per  year  contour.  On  average 
the  distance  from  both  contours  to  the  storage  site  is  comparable.  Local  differences  are  caused 
by  the  new  fragment  and  debris  throw  model. 
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ISO  Risk  Contours  Example.de 
Scenarios :  Selectionl 


NOT  internally  safe! 


[7  1 1  e-4 
17  1 1e-5 
17  |le-6 
17  |1e-7 
17  1 1e-8 
[7  1 1e-9 


Figure  8.  Risk  contours  for  the  Individual  Risk  (1/year)  for  various  values. 


Figure  9.  Risk  contours  for  the  Individual  Risk  (1/year)  10~5  contour.  Comparison  between 

Risk-NL  v5.0  and  Risk-NL  v4.1. 
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Figure  10  shows  the  FN-curve  together  with  the  criteria  for  existing  and  new  situations.  The 
FN-curve  just  satisfies  the  criterion  for  existing  situations. 


Societal  Risk  Graphs  HOT  internally  safe! 

Project:  Example.clc 
Date:  TO  Jun  201 D  16:35:01 


Ev  Selection  =  3.06e-03 
Norm  ratio  =  S.5S73 


1  10  1O0  1,000  10,000 

Number  of  fatalities 

Figure  10.  Societal  Risk ,  represented  by  the  FN  curve.  The  numbers  of  fatalities  are  the 

combined  numbers  of people  inside  buildings ,  on  roads  and  in  the  free  field*. 

When  situations  change,  e.g.  when  there  are  building  plans  or  there  is  an  increase  of 
population  or  traffic  somewhere  near  the  site,  or  when  changes  in  types  or  quantities  of  stored 
ammunition  or  explosives  are  considered,  there  may  be  a  danger  of  exceeding  the  allowed 
risk  limits.  In  such  cases,  a  detailed  study  of  which  storage  buildings  and  which  mechanisms 
make  the  most  significant  contributions  to  the  risks  is  worthwhile,  so  that  cost  effective 
measures  can  be  taken  to  reduce  the  risks. 

Risk-NL  provides  extensive  functionality  for  a  detailed  analysis  of  the  causes  of  exceedance 
of  risk  levels  at  certain  locations,  and  of  the  contributions  of  individual  storage  buildings  to 
the  Individual  Risk  as  well  as  the  Societal  Risk. 

Two  examples  are  discussed  below: 

1.  Reduction  of  the  quantity  of  stored  ammunition.  Figure  1 1  shows  the  effect  of  removing 
four  storage  buildings  from  the  storage  site.  The  result  can  be  compared  to  Figure  8.  A 
significant  reduction  of  the  Individual  Risk  can  be  observed  at  the  north  and  west  sides  of 
the  storage  site.  The  stored  ammunition  can  of  course  also  be  reduced  continuously. 

2.  Adding  barricades  to  storage  buildings.  Figure  12  shows  the  effect  of  adding  barricades  to 
a  selected  set  of  storage  buildings  in  the  southern  part  of  the  site.  Compared  to  Figure  8 
the  Individual  Risk  is  significantly  reduced  in  the  southern-west  part  of  the  map.  Besides 
the  addition  of  barricades  also  other  structural  measures  can  be  taken  into  account  like 
increasing  wall  thicknesses  or  building  dimensions,  or  adding  earth  cover. 

The  various  risk  reducing  measures  can  be  accounted  for  easily  and  quickly. 


1^  - New  situations 

p7  - Existing  situations 

p/  - Selection 
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Figure  11.  Risk  contours  for  the  Individual  Risk  (1/year)  for  various  values.  The  effect  of 

leaving  out  certain  storage  buildings. 
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Figure  12.  Risk  contours  for  the  Individual  Risk  (1/year)  for  various  values.  The  effect  of 
adding  barricades  to  a  number  of  storage  buildings. 
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Another  approach  to  reduce  the  risk,  is  to  look  more  specifically  at  the  risks  to  people  in  the 
free  field,  in  vehicles  and  in  buildings  to  find  out  which  risk  reducing  measures  could  be 
useful  at  the  acceptor  locations.  Using  Risk-NL  it  is  easy  to  distinguish  between  the  risks 
from  blast,  thermal  radiation,  debris  and  fragments  and  see  whether  risks  are  higher  to  people 
inside  or  outside  buildings  or  vehicles. 


Munition  Explosion 


▼J 


Environment 
C  Free  field 

(*  [Inside  building 
C  Inside  vehicle 


Phenomena 

F  Blast 

[7  Window  breakage 
W  Lung  damage 
W  Head  and  Body  Impact 
F  Collapse  of  building 
F  Thermal  radiation 


F  Debris/fragments 
1^  Horizontal 
Vertical 
Debris 

p  Fragments 

F  i.i  F  1.2 


Figure  13.  Possibility  to  choose  which  phenomena  and  which  type  of  acceptors  should  be 
taken  into  account.  6  Window  breakage’  and  ‘Collapse  of  building’  are  only  available  for  the’  Inside 
building’  situation. 


Figure  13  shows  the  possibilities  to  choose  which  phenomena  and  which  type  of  acceptors 
should  be  taken  into  account.  Figure  14  shows  the  risks  for  people  inside  buildings.  Note  that 
the  risk  for  persons  inside  buildings  influences  the  Societal  Risk,  but  not  the  Individual  Risk. 
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Figure  14.  Risk  for  persons  inside  buildings. 

Left  (a):  including  window  breakage;  Right  (b):  window  breakage  excluded. 
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Compared  to  Figure  8,  it  illustrates  clearly  that  the  probability  of  fatalities  due  to  blast  effects 
reaches  a  greater  distance  than  the  debris  and  fragment  effects  in  the  free  field.  Comparison 
between  Figure  14a  and  Figure  14b  shows  that  the  difference  is  entirely  due  to  the  relatively 
long  range  effect  of  window  breakage. 
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6.  Conclusions 

An  upgrade  of  Risk-NL  v4.1  to  Risk-NL  v5.0  has  been  carried  out  which  involved  the 
implementation  of  a  large  number  of  improved  models,  and  the  combination  of  Risk-NL  with 
RiskCurves. 

The  new  models  implemented  in  Risk-NL  v5.0  are  more  physics-based,  and  have  a  higher 
level  of  detail.  The  most  important  example  is  the  possibility  to  distinguish  between  wall  and 
roof  debris  and  between  debris  and  fragments.  The  combination  of  the  new  models  in  Risk- 
NL  v5.0  and  RiskCurves  give  unique  possibilities  to  analyse  risk,  and  to  investigate  options 
for  risk  reduction.  Risk-NL  v5.0  also  provides  possibilities  for  optimization  in  the  design  of 
new  types  of  magazines  and  magazine  complexes. 

Risk-NL  v5.0  has  been  illustrated  with  a  case  study.  The  results  showed  that  the  Individual 
Risk  contours  locally  differ  from  those  calculated  with  Risk-NL  v4.1.  The  differences  can  be 
explained  well  by  the  improved  models.  Often  the  differences  are  caused  by  the  directionality 
of  debris  throw.  The  new  window  failure  model  in  Risk-NL  v5.0  has  a  significant  influence 
on  the  Societal  Risk. 
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TNO  Defence,  Security  and  Safety 


Introduction 


Risk-NL 

•  Quantitative  Risk  Assessment  (QRA)  software  tool 

•  External  safety  of  the  storage  of  explosives  and  ammunition 

•  About  50  NLD  storage  sites  analysed  between  2001-2007 

Upgrade  Risk-NL 

•  Project  sponsored  by  NLD  MoD 

•  Risk-NL  v4.1  ■  o  Risk-NL  v5.0 

•  Improved  models 

•  New  user-interface 

Risk-NL  performs  three  sequential  steps 

•  Internal  Safety 

•  ABC  Zoning 

•  QRA  calculations 

•  Individual  Risk 

•  Societal  Risk 


Internal  Safety 

•  Analysis  of  the  Internal  Safety 

•  Exclusion  of  sympathetic  detonation 

•  NLD  regulations:  MP40-21 

•  1 1  magazine  types 

•  New  option: 

•  According  to  adjusted  AASTP-1 

•  33  magazine  types 


Voorschrift  opslag  gevaarlijke  stoffen  MP  40-21 

Bijlage  9.  Veiligheidsafstanden  op  munitiecomplexen _ (8-97)  B9  -  4 
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Zoning 


Implementation  of  QDs  for  Small  Quantities 


■  Brick 

■  RC 

RC  &  Brick  small  scale 

■  ISO 

■  ECM,  front 

■  ECM,  side  &  rear 

■  HAS,  front 

■  HAS,  side  &  rear 
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Quantitative  Risk  Assessment  (QRA) 

•  The  basis  of  the  QRA  calculations  is  the  risk  equation: 

Risk  =  Pevent  •  Plethal  ■  Pexv  osure  ( 1  /year) 

•  Assumptions 

•  One  scenario  per  PES 

•  Maximum  Credible  Event  (MCE) 

•  Mixing  and  Aggregation  rules  from  AASTP-1 

•  No  escape  behaviour 

•  The  event  frequency  (1/year) 

•  Based  on  accident  data  1960-1980 

•  Regular  storage,  irregular  storage,  storage  in  vehicles 

•  The  probability  of  lethality  given  the  event  (-) 

•  See  next  slides 

•  The  probability  of  exposure  (-) 

•  Individual  risk  (100  %  exposure,  unprotected) 

•  Societal  risk  (more  realistic  measure) 
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Window  failure 

•  New  window  failure  model  (Doormaal) 

•  Based  on  representative  NLD  windows 

•  Double  and  single  glazing 

•  AIS  (Abbreviated  Injury  Score)  prediction 

•  New  probit  function  for  lethality 


10000 


Debris  and  fragment  throw 

•  New  debris  and  fragment  throw  model  distinguishes  between 
•  Wall  and  roof  debris  Barricades 


•  Debris  and  (primary)  fragments  i  Bare  vs.  Cased 


•  Distributions  of: 

•  Mass  (10  bins) 

•  Velocity 

•  Angle 

•  Trajectory  calculations 

•  Analytical  approach 

•  Penetration  relations 

•  Number  of  hits 

•  Lethality  prediction 


Source  function  fragments 
Source  function  debris 


Debris  and  fragment  throw 

•  Validation  against  large  number  of  trials 
•  Example:  5  tonnes  trial 
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Thermal  radiation 

•  HD1 .3  event;  mass  fire 

•  Risk-NLv5.0: 

•  Nieuw  model  with  distinction  between 

•  Light  structures:  fire  ball 

•  Heavy  structures:  flame  jet  through  doors/openings 

•  Fire  ball 

•  Model  for  fire  ball  radius  and  duration 

•  Model  for  irradiance 

•  Flam  jet 

•  Model  for  flame  jet  length  and  duration 

•  Model  for  radiation  irradiance 


Case  study 


Fictitious  storage  site 
Selection  of: 

•  Background  map 

•  Population  grid  /  population  concentrations 
(day/night/temporarily) 

•  T  raffic  data 

•  Storage  buildings 


■W  Risk-NL  v5.0  - 
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C:\Users\Gebruiker\Documents\Risk-NL  Projects\Example\ Data  saved 


Case  study 

•  Internally  Safe  (Y/N) 

•  Displayed  on  maps  and  charts 

•  Changes  may  be  required 


•  ABC  Zoning 

•  Union  of  individual  zones 

•  Comparison  with  regulations 

•  Objects  within  zones 

•  QRA  is  required  ! 


NOT  internally  safe! 
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Case  study 

•  Individual  Risk 

•  Contours  for  ICH,  10  5,  10'6,  10'7,  10'8,  and  10'9 

ISO  Risk  Contours  Example .clc  not  internally  safe! 

Scenarios :  Selectionl 


Case  study 


•  Individual  Risk 

•  Comparison  between  Risk-NL  v4.1  and  Risk-NL  v5.0 


NOT  intemafy  safe! 
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W - Selection 
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Case  study 


•  Risk  Reduction 

•  Leaving  storage  buildings  empty 

•  Reducing  the  NEQ 
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£)  Risk-NL  v5  0  -  C:\Users\Gebruiker\Documents\Risk-NL  Projects\Example\Example.clc 
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ISO  Risk  Contours  Example  .clc 
Scenarios :  All  scenarios 
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Case  study 

•  Risk  Reduction 

•  Adding  barricades  to  a  number  of  storage  buildings  (south) 


ISO  Risk  Contours  Example  .clc 
Scenarios :  All  scenarios 
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ISO  Risk  Contours  Example  .clc 
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Case  study 


•  Individual  Risk  Contours 
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Risk  contours  for  persons  in  buildings  (or  vehicles) 
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Or:  User  defined  selection  of  lethality  mechanisms 


im 


Case  study 


•  Risk  contours  for  persons  in  buildings 

•  Without  window  failure  (left) 

•  With  window  failure  (right) 


ISO  Risk  Contours  Example  .clc 
Scenarios :  Selectionl 
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Conclusions 


Upgrade  of  Risk-NL  v4.1  to  Risk-NL  v5.0 

•  Large  number  of  improved  models 

•  More  physics-based 

•  Higher  level  of  detail 

•  Combination  of  Risk-NL  with  RiskCurves. 

New  debris  and  fragment  throw  model  distinguishes  between 

•  Wall  and  roof  debris 

•  Debris  and  fragments 
New  window  failure  model 

Differences  between  Risk-NL  v5.0  and  Risk-NL  v4.1 

•  Individual  Risk  (debris  and  fragment  throw) 

•  Societal  Risk  (window  failure) 

Possibilities  to 

•  Analyse  risk  reduction 

•  Optimise  design  of  magazines  and  storage  sites 


